@humwick/server 0.130.1 → 0.130.3

package/src/workspace-actions.ts

@@ -1,3 +1,6 @@
+import { prepareCommandWriteAsync, createCommandAsync, submitPreparedCommandAsync } from "./commands-write";
+import type { ReviewCleanupInput } from "./db/review-publish-write";
+import { getGateway } from "./db/gateway";
 import { recordWorkspaceAudit } from "./workspace-action-audit";
 import { WORKSPACE_MERGE_HOLD_MESSAGE } from "./db/workspace-merge-hold";
 import { stewardGenerationCanceled } from "./db/workspace-steward-fence";
@@ -14,22 +17,13 @@ import { stringValue } from "@humwick/sdk";
 // `requestWorkspaceMerge`, the core does not emit the command event; it returns
 // the Command and the caller emits via its own `emitCommand` (kept module-local).
 
-import { createCommand } from "./commands-db";
+
 import { requestWorkspaceRekey } from "./workspace-rekey";
 import { isWorkspaceSteward, workspaceStewardRefusal } from "./workspace-steward-authority";
 import { getStewardConfig } from "./config-store";
 import { cancelPendingLegacyLandingsAsync } from "./commands-landing-async";
 import { workspaceOwnerOrchestrator } from "./workspace-host";
-import {
-  getWorkspace,
-  claimWorkspaceMetadataAsync,
-  listOrchestrators,
-  patchWorkspaceMetadataAsync,
-  releaseWorkspaceClaimMetadataAsync,
-  setWorkspaceMergeHoldAsync,
-  transitionWorkspaceLandStateAsync,
-  updateWorkspaceStatusAsync,
-} from "./db";
+import { getWorkspace, claimWorkspaceMetadataAsync, listOrchestrators, patchWorkspaceMetadataAsync, releaseWorkspaceClaimMetadataAsync, setWorkspaceMergeHoldAsync, transitionWorkspaceLandStateAsync, updateWorkspaceStatusAsync, REVIEW_HOLD_REJECT_MESSAGE, workspaceLandBarrier } from "./db";
 import { isOwnerAlive, requestWorkspaceMerge } from "./workspace-merge";
 import { buildWorkspaceCleanupCommand } from "./workspace-cleanup-stale";
 // Re-export the land-strategy contract so the MCP land tool validates against the same
@@ -38,15 +32,13 @@ export { LAND_STRATEGIES } from "./workspace-merge";
 import { claimMetadataPatch, workspaceActiveClaim, workspaceStewardHandbackPending } from "./workspace-claim";
 import { DIRTY_WORKTREE_LAND_SKIP_REASON, LAND_IN_FLIGHT_STATUSES, READY_TO_LAND_STATUSES, TERMINAL_WORKSPACE_STATUSES, worktreeReapable } from "./workspace-phase";
 import { LAND_BLOCK_REJECT_MESSAGE, stripReservedWorkspaceMetadataKeys } from "./land-block";
-import { REVIEW_HOLD_REJECT_MESSAGE, workspaceLandBarrier } from "./db";
 import { CLEAR_MERGE_NO_PROGRESS, scheduleRepoMerge } from "./workspace-auto-merge";
 import { archiveLandAttempt, CLEAR_LAST_ATTEMPT_VERDICT, CLEAR_MERGE_RETRY } from "./workspace-merge-progress";
 import { fetchHostMergePreview, refreshWorkspaceGitState } from "./workspace-probe";
 import { recordLandStopped } from "./workspace-land-stopped";
 import { finishWorkspaceStewardHandoff } from "./steward-handoff";
 import { stewardHandoffIdentity } from "./steward-provenance";
-import type { Command, WorkspaceAutoMergePolicy, WorkspaceLandingPolicy, WorkspaceMergeStrategy, WorkspaceRecord, WorkspaceStatus } from "./types";
-import type { WorkspaceLandGateLevel } from "./types";
+import type { Command, WorkspaceAutoMergePolicy, WorkspaceLandingPolicy, WorkspaceMergeStrategy, WorkspaceRecord, WorkspaceStatus, WorkspaceLandGateLevel } from "./types";
 import type { WorkspaceLandGateAuth } from "./workspace-land-gate";
 
 // Single source of truth for the action verb set. The route's `optionalEnum` and
@@ -326,7 +318,7 @@ export async function applyWorkspaceAction(workspace: WorkspaceRecord, input: Ap
       return { ok: false, httpStatus: 422, error: `workspace ${workspace.id} has no isolated worktree to refresh` };
     }
     const checkOnly = input.checkOnly === true;
-    const built = buildWorkspaceDepsRefreshCommand(workspace, agentId ?? "agent", checkOnly);
+    const built = (await buildWorkspaceDepsRefreshCommand(workspace, agentId ?? "agent", checkOnly));
     if (!built.ok) return { ok: false, httpStatus: built.status, error: built.error };
     await recordWorkspaceAudit({
       action,
@@ -416,11 +408,11 @@ export async function applyWorkspaceAction(workspace: WorkspaceRecord, input: Ap
         error: `workspace ${workspace.id} cannot be cleaned up safely: ${safety.error}; pass force:true with a detail reason only if intentionally discarding work`,
       };
     }
-    const built = buildWorkspaceCleanupCommand(workspace, agentId ?? "dashboard", {
+    const built = (await buildWorkspaceCleanupCommand(workspace, agentId ?? "dashboard", {
       force: input.force === true,
       reason: detail,
       autoReclaim: input.autoReclaim,
-    });
+    }));
     if (!built.ok) return { ok: false, httpStatus: built.status, error: built.error };
     command = built.command;
   }
@@ -496,17 +488,17 @@ export async function applyWorkspaceAction(workspace: WorkspaceRecord, input: Ap
 // captured delivered `sha`. #1452 round-5 H4: the relay deliberately does NOT derive or return a
 // ref — the AUTHORITATIVE ref is whatever the HOST reports back on the command result (the host may
 // run a different sanitizer version), and the ledger records it only after that settlement.
-export function buildWorkspacePublishReviewCommand(
+export async function buildWorkspacePublishReviewCommand(
   workspace: WorkspaceRecord,
   requestedBy: string,
-  opts: { taskId?: number; sha?: string; reviewRef?: string } = {},
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+  opts: { taskId?: number; sha?: string; reviewRef?: string; cleanup?: ReviewCleanupInput } = {},
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   if (workspace.mode !== "isolated" || !workspace.worktreePath) {
     return { ok: false, status: 422, error: `workspace ${workspace.id} has no worktree to publish for review` };
   }
   const owner = workspaceOwnerOrchestrator(workspace, listOrchestrators(), { onlineOnly: false });
   if (!owner) return { ok: false, status: 409, error: "no orchestrator owns this workspace path" };
-  const command = createCommand({
+  const prepared = await prepareCommandWriteAsync({
     type: "workspace.publish-review",
     source: "system",
     target: owner.agentId,
@@ -527,6 +519,9 @@ export function buildWorkspacePublishReviewCommand(
       queued: owner.status !== "online",
     },
   });
+  const command = opts.cleanup
+    ? await getGateway().write("commands.createReviewPublish", { command: prepared, cleanup: opts.cleanup }) as unknown as Command
+    : await submitPreparedCommandAsync(prepared);
   return { ok: true, command };
 }
 
@@ -537,10 +532,10 @@ export function buildWorkspacePublishReviewCommand(
 // caller passes the EXACT host-confirmed `ref` from the ledger and the host deletes THAT ref verbatim
 // (after asserting it is under refs/review/*) — it no longer re-derives the target from branch/
 // workspaceId, which could diverge across a relay/host sanitizer skew and leak the real ref.
-export function buildReviewRefUnpublishCommandFromFields(
+export async function buildReviewRefUnpublishCommandFromFields(
   fields: { workspaceId: string; repoRoot: string; worktreePath?: string; branch?: string; orchestratorId?: string; ref?: string },
   requestedBy: string,
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   const synthetic = {
     orchestratorId: fields.orchestratorId,
     sourceCwd: fields.repoRoot,
@@ -550,7 +545,7 @@ export function buildReviewRefUnpublishCommandFromFields(
   } as unknown as WorkspaceRecord;
   const owner = workspaceOwnerOrchestrator(synthetic, listOrchestrators(), { onlineOnly: false });
   if (!owner) return { ok: false, status: 409, error: "no orchestrator owns this repo path" };
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "workspace.unpublish-review",
     source: "system",
     target: owner.agentId,
@@ -566,20 +561,20 @@ export function buildReviewRefUnpublishCommandFromFields(
       requestedAt: Date.now(),
       queued: owner.status !== "online",
     },
-  });
+  }));
   return { ok: true, command };
 }
 
 // Build a `workspace.deps-refresh` command for a worktree's owning orchestrator
 // (issue #51). checkOnly just reports staleness. Same owner-resolution as cleanup.
-function buildWorkspaceDepsRefreshCommand(
+async function buildWorkspaceDepsRefreshCommand(
   workspace: WorkspaceRecord,
   requestedBy: string,
   checkOnly: boolean,
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   const owner = workspaceOwnerOrchestrator(workspace, listOrchestrators(), { onlineOnly: false });
   if (!owner) return { ok: false, status: 409, error: "no online orchestrator owns this workspace path" };
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "workspace.deps-refresh",
     source: "system",
     target: owner.agentId,
@@ -594,7 +589,7 @@ function buildWorkspaceDepsRefreshCommand(
       requestedAt: Date.now(),
       queued: owner.status !== "online",
     },
-  });
+  }));
   return { ok: true, command };
 }
 

package/src/workspace-auto-merge.ts

@@ -1,3 +1,5 @@
+import { workspaceLandRefused } from "./workspace-land-refusal";
+import { refreshPendingLandQueueLeaseAsync } from "./db/runtime-tail-async";
 // Event-driven workspace merge-back engine (#237).
 //
 // The branch merge-back used to be driven entirely by a 2-min maintenance poll, so an
@@ -30,8 +32,8 @@ import {
   patchWorkspaceMetadataAsync,
   updateWorkspaceStatus,
   workspaceLandBarrier, updateWorkspaceStatusAsync} from "./db";
-import { findLatestCommandByCorrelation } from "./commands-db";
-import { refreshPendingLandQueueLease } from "./db/commands-claim-admission";
+import { findLatestCommandByCorrelationAsync } from "./commands-write";
+
 import { notifyBranchLandFailed } from "./branch-landed";
 import { resolveStewardIdentity } from "./steward-identity";
 import { emitCommandEvent } from "./command-events";
@@ -144,14 +146,14 @@ async function escalateNoProgressMerge(ws: WorkspaceRecord, _tip?: string): Prom
   const payload = { kind: "workspace.auto-merge-stuck", workspaceId: ws.id, repoRoot: ws.repoRoot, branch: ws.branch, baseRef: ws.baseRef, attempts: MAX_NO_PROGRESS_MERGE_ATTEMPTS, reason: mergeError };
   let escalated = false;
   if (recipients.length) {
-    notifyBranchLandFailed({ workspace: ws,
+    await notifyBranchLandFailed({ workspace: ws,
       commandId: typeof meta.mergeCommandId === "string" ? meta.mergeCommandId : undefined,
       recipients,
       reason: `auto-merge backed off after ${MAX_NO_PROGRESS_MERGE_ATTEMPTS} no-progress attempts (${mergeError})`,
     });
     escalated = true;
   } else {
-    const human = notifyWorkspaceHumanEscalation({ subject, body, payload, source: "workspace-auto-merge" });
+    const human = (await notifyWorkspaceHumanEscalation({ subject, body, payload, source: "workspace-auto-merge" }));
     escalated = human.accepted;
     if (!human.accepted) {
       console.warn(`[workspace-auto-merge] no-progress escalation for ${ws.id} had zero agent recipients and no human channel: ${human.reason ?? "unknown reason"}`);
@@ -180,7 +182,7 @@ async function notifyProtectedTipRestore(ws: WorkspaceRecord, preview: Workspace
   // whose delivered tip was discarded CANNOT reach landed-on-main by any land path until the carry is
   // explicitly confirmed. Returns ok=false if it could NOT durably record the obligation — the caller
   // fails closed on that (withholds the steward hand-off) rather than risk a silent divergent land.
-  const carry = markWorkspaceTasksCarryPending(ws, discardedHead);
+  const carry = await markWorkspaceTasksCarryPending(ws, discardedHead);
   const body = `Workspace \`${ws.branch ?? ws.id}\` restored protected tip \`${preview.protectedTip?.slice(0, 12) ?? "unknown"}\`; discarded HEAD \`${discardedHead.slice(0, 12)}\` was preserved at \`${discardedRef}\`.`;
   await createActivityEventAsync({
     clientId: `workspace-protected-tip-restore-${ws.id}-${Date.now()}`,
@@ -198,7 +200,7 @@ async function notifyProtectedTipRestore(ws: WorkspaceRecord, preview: Workspace
   const { coordinatorAgentId } = resolveStewardIdentity(current);
   const recipients = [...new Set([coordinatorAgentId, current.ownerAgentId].filter((r): r is string => Boolean(r)))];
   if (recipients.length) {
-    routeNotification({
+    await routeNotification({
       type: "workspace.land_gate_warning",
       scope: { workspaceId: current.id, repoRoot: current.repoRoot, author: current.ownerAgentId, parent: coordinatorAgentId ?? undefined },
       recipients,
@@ -492,7 +494,7 @@ async function landCandidates(
         }
       }
       if (p.conflict === true || protectedTipRestored) {
-        emitWorkspaceTaskSemanticNotifications({
+        await emitWorkspaceTaskSemanticNotifications({
           workspace: ws,
           transition: "land-conflict",
           actor: "workspace-auto-merge",
@@ -616,7 +618,7 @@ function landableWorkspaces(repoRoot?: string, baseRef?: string): WorkspaceRecor
       // `review_requested` with NO authorization; after the coordinator's clear the flag is off
       // and the promoted delivery lands normally). Covers all three sweep triggers (event,
       // backstop, watchdog) and the conflict→steward hand-off at this single selection filter.
-      && !workspaceLandBarrier(ws).blocked
+      && !workspaceLandBarrier(ws).blocked && !workspaceLandRefused(ws)
       // #1473 — nor is a workspace bound to a deliverable Task that has NOT authorized a land: a pushed
       // `agent/*` branch in a ready-to-land status is not, by itself, a land authorization (a "HOLD" is
       // coordinator convention only). Excluding it here keeps it out of BOTH the auto-land dispatch and
@@ -761,9 +763,9 @@ function commandIsTerminal(command: Command | null): boolean {
   return Boolean(command && TERMINAL_COMMAND_STATUSES.has(command.status));
 }
 
-function latestWorkspaceCommand(ws: WorkspaceRecord): Command | null {
+async function latestWorkspaceCommand(ws: WorkspaceRecord): Promise<Command | null> {
   const type = LAND_IN_FLIGHT_STATUSES.has(ws.status) ? "workspace.merge" : "workspace.cleanup";
-  return findLatestCommandByCorrelation(type, ws.id);
+  return findLatestCommandByCorrelationAsync(type, ws.id);
 }
 
 async function recoverAgedInFlightWorkspaces(now: number, signal?: AbortSignal): Promise<Record<string, unknown>> {
@@ -803,9 +805,9 @@ async function recoverAgedInFlightWorkspaces(now: number, signal?: AbortSignal):
     // young merge_planned row the 20-min age gate would otherwise skip. Only a merge_planned row can be
     // executor-orphaned, so a young cleanup_requested/non-merge row still pays NO command lookup (the
     // pre-#2094 cost) — fetch only when the row is old enough for the existing recovery OR could be an orphan.
-    let command = (LAND_IN_FLIGHT_STATUSES.has(ws.status) || oldEnough(ws)) ? latestWorkspaceCommand(ws) : null;
+    let command = (LAND_IN_FLIGHT_STATUSES.has(ws.status) || oldEnough(ws)) ? await latestWorkspaceCommand(ws) : null;
     if (command?.status === "pending" && command.type === "workspace.merge") {
-      if (refreshPendingLandQueueLease(command.id, now)) {
+      if ((await refreshPendingLandQueueLeaseAsync(command.id, now))) {
         stillActive.push(ws.id);
         continue;
       }

package/src/workspace-changed-paths-client.ts

@@ -1,6 +1,7 @@
 import type { ChangedPathDiff } from "@humwick/sdk";
 import { decideDiffGate, type DiffGateDecision } from "./services/diff-gate";
 import { fetchOwningHostJson } from "./workspace-host-client";
+import { workspaceHeadAlreadyOnBase } from "./services/task-nothing-to-land";
 import type { WorkspaceRecord } from "./types";
 
 /**
@@ -87,11 +88,21 @@ export async function resolveDeliveryDiffDecision(
         ...(reprobe.ok ? { headSha: reprobe.headSha } : {}),
       };
     }
-    return { decision: decideDiffGate(reprobe), ...(reprobe.headSha ? { headSha: reprobe.headSha } : {}) };
+    return await classify(workspace, reprobe);
   }
+  return await classify(workspace, probe);
+}
+
+/** A head the owning host proves is already on the freshly fetched base lands nothing, so no
+ * gate can protect anything: accept it without one (#3214). Probed only on the would-gate path. */
+async function classify(workspace: WorkspaceRecord, probe: ChangedPathDiff): Promise<DeliveryDiffEvidence> {
   const decision = decideDiffGate(probe);
-  return {
-    decision,
-    ...(probe.ok && probe.headSha ? { headSha: probe.headSha } : {}),
-  };
+  if (!probe.ok || !probe.headSha) return { decision };
+  if (decision.requireGates && await workspaceHeadAlreadyOnBase(workspace, probe.headSha)) {
+    return {
+      decision: { requireGates: false, reason: `delivered head ${probe.headSha.slice(0, 12)} is already on ${workspace.baseRef ?? "main"}: nothing lands`, paths: probe.paths },
+      headSha: probe.headSha,
+    };
+  }
+  return { decision, headSha: probe.headSha };
 }

package/src/workspace-cleanup-stale.ts

@@ -1,3 +1,4 @@
+import { createCommandAsync } from "./commands-write";
 // Cleanup-stale workspace reconciliation: builds the `workspace.cleanup` command and runs the
 // `workspace cleanup-stale --check/--execute` sweep (#208/#965/#1066). Kept as a standalone leaf
 // module (no workspace-auto-merge.ts dependency) so the transient-agent reap lifecycle (#1477)
@@ -7,7 +8,7 @@
 
 import { statSync } from "node:fs";
 import { emitCommandEvent } from "./command-events";
-import { createCommand } from "./commands-db";
+
 import { getAgent, listWorkspaces, updateWorkspaceStatusAsync } from "./db";
 import { fetchWorkspaceGitState } from "./workspace-git-state-client";
 import { workspaceOwnerOrchestrator } from "./workspace-host";
@@ -15,15 +16,15 @@ import { workspaceActiveClaim } from "./workspace-claim";
 import { isOwnerAlive, isOwnerProcessConfirmedGone, liveAgentCwds, worktreeInUseByLiveAgent } from "./workspace-merge";
 import { refResolvesInRepo, verifyLandedOrEquivalentContent } from "./services/landed-ancestry";
 import { TERMINAL_WORKSPACE_STATUSES } from "./workspace-phase";
-import type { Command, WorkspaceRecord } from "./types";
+import type { Command, WorkspaceRecord, WorkspaceOrphan } from "./types";
 
 // Build a `workspace.cleanup` command for the worktree's owning orchestrator.
 // Moved here (from routes.ts) so the MCP surface reaches it without importing routes.
-export function buildWorkspaceCleanupCommand(
+export async function buildWorkspaceCleanupCommand(
   workspace: WorkspaceRecord,
   requestedBy: string,
   opts: { force?: boolean; reason?: string; autoReclaim?: "origin-captured" } = {},
-): { ok: true; command: Command } | { ok: false; status: number; error: string } {
+): Promise<{ ok: true; command: Command } | { ok: false; status: number; error: string }> {
   if (
     opts.force !== true &&
     workspace.mode === "isolated" &&
@@ -38,7 +39,7 @@ export function buildWorkspaceCleanupCommand(
   }
   const owner = workspaceOwnerOrchestrator(workspace);
   if (!owner) return { ok: false, status: 409, error: "no online orchestrator owns this workspace path; retry when the host is online or use DELETE /api/workspaces/:id to purge the record" };
-  const command = createCommand({
+  const command = (await createCommandAsync({
     type: "workspace.cleanup",
     source: "system",
     target: owner.agentId,
@@ -58,7 +59,7 @@ export function buildWorkspaceCleanupCommand(
       ...(opts.autoReclaim === "origin-captured" ? { autoReclaim: "origin-captured" } : {}),
       queued: false,
     },
-  });
+  }));
   return { ok: true, command };
 }
 
@@ -190,7 +191,7 @@ export async function cleanupStaleWorkspaces(opts: CleanupStaleWorkspacesOptions
       } else {
         // Owner re-confirmed offline just above; force past buildWorkspaceCleanupCommand's
         // live-owner guard and carry a reason so the host records an intentional force-discard.
-        const built = buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {});
+        const built = (await buildWorkspaceCleanupCommand(ws, "cleanup-stale", forced ? { force: true, reason: "operator force-discard: abandoned branch, owner offline" } : {}));
         if (built.ok) {
           await updateWorkspaceStatusAsync(ws.id, "cleanup_requested", { lastWorkspaceAction: "cleanup-stale", lastWorkspaceActionAt: Date.now(), cleanupProof: { ...proof, forced } });
           emitCommandEvent(built.command, "command.requested");
@@ -229,3 +230,25 @@ export async function cleanupStaleWorkspaces(opts: CleanupStaleWorkspacesOptions
   }
   return { dryRun, landedOnly, force, repoRoot, ...(workspaceId ? { workspaceId } : {}), ...(workspaceIds ? { workspaceIds } : {}), scanned: candidates.length, eligible: rows.filter((r) => r.discardable).length, cleaned, candidates: rows };
 }
+
+export async function dispatchOrphanCleanup(targetAgentId: string, orphan: WorkspaceOrphan): Promise<string> {
+  const command = (await createCommandAsync({
+    type: "workspace.cleanup",
+    source: "system",
+    target: targetAgentId,
+    params: {
+      action: "cleanup",
+      worktreePath: orphan.worktreePath,
+      repoRoot: orphan.repoRoot,
+      branch: orphan.branch,
+      baseRef: orphan.baseRef,
+      baseSha: orphan.baseSha,
+      deleteBranch: true,
+      reclaim: true,
+      requestedBy: "workspace-orphan-reaper",
+      requestedAt: Date.now(),
+    },
+  }));
+  emitCommandEvent(command, `command.${command.status}`);
+  return command.id;
+}

package/src/workspace-command-settle.ts

@@ -1,9 +1,12 @@
+import { DELEGATED_LAND_REFUSAL_CODE } from "@humwick/sdk/worktree-config";
+import { refuseWorkspaceLand } from "./workspace-land-refusal";
+import { releaseMergeLeaseAsync, insertLandGateAttestationAsync } from "./db/runtime-tail-async";
 import { commandFailureReason, settleWorkspaceCleanupCommand, type WorkspaceCommandSettleResult } from "./workspace-cleanup-settle";
 export { type WorkspaceCommandSettleResult } from "./workspace-cleanup-settle";
 import { fireAndForget, isRecord, sanitizeFsName, stringValue, type LandGateAttestation, type LandGateRunResult } from "@humwick/sdk";
 import { storeTextArtifact } from "./artifact-text";
 import { announceBranchLanded, notifyBaseWorktreeStrand, notifyBranchLandFailed, notifyLandGateFailed, notifyLandGateSkipped, notifyLandGateWarnings, recordLandingReceipt } from "./branch-landed";
-import { getWorkspace, getArtifactAsync, insertLandGateAttestation, listOrchestrators, markWorkspaceLanded, patchWorkspaceMetadataAsync, releaseMergeLease, setWorkspaceBranchAsync, updateWorkspaceStatusAsync, markWorkspaceLandedAsync} from "./db";
+import { getWorkspace, getArtifactAsync, listOrchestrators, markWorkspaceLanded, patchWorkspaceMetadataAsync, setWorkspaceBranchAsync, updateWorkspaceStatusAsync, markWorkspaceLandedAsync } from "./db";
 import { parseOwnerRepoFromRemote, repoFromGitRemote } from "./services/git-remote";
 import { deferLandSettleSideEffect } from "./land-settle-dispatch";
 import { recordConfirmedLandBoundary } from "./services/land-boundary-settle";
@@ -205,7 +208,7 @@ export async function settleWorkspaceMergeCommand(command: Command, opts: Worksp
     command = proven;
   }
   const terminalSettled = WORKSPACE_MERGE_SETTLED_STATUSES.has(command.status);
-  if (terminalSettled && command.landingContainmentMode === "legacy-unfenced-v0") releaseMergeLease({ commandId: command.id });
+  if (terminalSettled && command.landingContainmentMode === "legacy-unfenced-v0") (await releaseMergeLeaseAsync({ commandId: command.id }));
   const settledRepoRoot = typeof command.params.repoRoot === "string" ? command.params.repoRoot : undefined;
   const settledBaseRef = typeof command.params.baseRef === "string" ? command.params.baseRef : undefined;
   let transitionCompleted = false;
@@ -280,7 +283,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     // genuine-but-unverifiable land on its next pass instead of it being stranded as falsely-landed.
     const landTargetRef = landedWorkspace?.baseRef ?? "main";
     const landAncestry = mergeResult.merged === true && !prLanded && landedCommitCount !== 0 && landedWorkspace
-      ? await verifyWorkspaceLandedAncestry(landedWorkspace.repoRoot, authoritativeLandedSha, landTargetRef, cleanString(mergeResult.landVerifiedSha, "result.landVerifiedSha", { max: 64 }))
+      ? await verifyWorkspaceLandedAncestry(landedWorkspace.repoRoot, authoritativeLandedSha, landTargetRef.startsWith("origin/") ? landTargetRef : `origin/${landTargetRef}`, cleanString(mergeResult.landVerifiedSha, "result.landVerifiedSha", { max: 64 }))
       : "confirmed";
     const ancestryUnconfirmed = landAncestry !== "confirmed";
     const normalizedStatus = ancestryUnconfirmed
@@ -360,13 +363,13 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     if (retryableNonLand) {
       if (ancestryUnconfirmed && landedWorkspace) {
         const ws = transitioned ?? landedWorkspace;
-        deferLandSettleSideEffect("land-unconfirmed", () => notifyLandUnconfirmed({ workspace: ws, commandId: command.id, sha: authoritativeLandedSha, targetRef: landTargetRef, kind: landAncestry }));
+        deferLandSettleSideEffect("land-unconfirmed", async () => await notifyLandUnconfirmed({ workspace: ws, commandId: command.id, sha: authoritativeLandedSha, targetRef: landTargetRef, kind: landAncestry }));
       }
       return { settled: true };
     }
     const noopBase = nothingBase ?? (mergeResult.noop === true && !resultError && mergeResult.landMechanism !== "plain-git" && (resultStatus === "merged" || resultStatus === "active") && typeof baseSha === "string" && /^[0-9a-f]{40,64}$/.test(baseSha) ? baseSha : undefined);
     if (noopBase && landedWorkspace) await finishWorkspaceStewardHandoff(landedWorkspace);
-    if (noopBase && landedWorkspace) deferLandSettleSideEffect("nothing-to-land", () => notifyNothingToLand(landedWorkspace, noopBase, command.id, typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha : undefined));
+    if (noopBase && landedWorkspace) deferLandSettleSideEffect("nothing-to-land", async () => await notifyNothingToLand(landedWorkspace, noopBase, command.id, typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha : undefined));
     const landConfirmed = !nothingBase && workspaceMergeProvesLand(mergeResult, command.params);
     const continuationBranch = normalizedStatus === "active" ? landedWorkspace?.branch : undefined;
     // #1790 F1 — build the land notice up front so the durable RECEIPT can be written SYNCHRONOUSLY,
@@ -381,6 +384,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         taskIds: resolveLandedTaskIds({ workspace: landedWorkspace,
           sourceHeadSha: typeof command.params.expectedHeadSha === "string" ? command.params.expectedHeadSha : undefined }),
         mergedSha: authoritativeLandedSha,
+        ...(landAncestry === "confirmed" && !prLanded ? { landVerifiedSha: authoritativeLandedSha } : { landVerifiedSha: stringValue(mergeResult.landVerifiedSha) }),
         // Git/PR titles have no 200-character limit. Bound display text without rejecting the land (#3244).
         subject: stringValue(prLanded ? prLanded.subject : mergeResult.subject)?.slice(0, 200),
         prLand: Boolean(prLanded),
@@ -392,7 +396,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         ...(prLanded || landedCommitCount === undefined ? {} : { landedCommitCount }),
       }
       : undefined;
-    if (landedNotice) recordLandingReceipt(landedNotice);
+    if (landedNotice) (await recordLandingReceipt(landedNotice));
     // #1744 F1 — record the tree-keyed land-gate attestation. Placed HERE, not at the executor, so
     // that "the full gate passed on tree T" only becomes deployable evidence once the relay has
     // CONFIRMED (ancestry-gated above, #1713) that T actually reached the base ref: a gated attempt
@@ -407,7 +411,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         const repo = landRepo(landedWorkspace.repoRoot);
         // No resolvable origin ⇒ no shared identity with cd-watcher's detection clone ⇒ no row.
         if (repo) {
-          insertLandGateAttestation({
+          (await insertLandGateAttestationAsync({
             repo,
             treeSha: attestation.treeSha,
             commitSha: authoritativeLandedSha,
@@ -418,7 +422,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
             gatesRan: attestation.gatesRan,
             workspaceId: landedWorkspace.id,
             ...(attestation.suiteCoverage ? { suiteCoverage: attestation.suiteCoverage } : {}),
-          });
+          }));
         }
       } catch (error) {
         console.warn(`[land-gate-attestation] failed to record tree ${attestation.treeSha.slice(0, 12)} for ${workspaceId}: ${String(error)}`);
@@ -438,7 +442,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         preservedWipPaths: Array.isArray(baseWorktreeSync.preservedWipPaths) ? baseWorktreeSync.preservedWipPaths.filter((p): p is string => typeof p === "string") : undefined,
         message: typeof baseWorktreeSync.message === "string" ? baseWorktreeSync.message : undefined,
       };
-      deferLandSettleSideEffect("base-worktree-strand", () => notifyBaseWorktreeStrand({ workspace: ws, sync: strandSync }));
+      deferLandSettleSideEffect("base-worktree-strand", async () => await notifyBaseWorktreeStrand({ workspace: ws, sync: strandSync }));
     }
     // #1713 — reaching here means the land is either ancestry-CONFIRMED, a remote-verified PR land, or
     // a proven zero-commit no-op (handled inside announceBranchLanded, #1620); an unconfirmed
@@ -449,7 +453,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     // i.e. the serialized writes this issue is about — so it runs off the settle hot path.
     if (landedNotice) {
       const notice = landedNotice;
-      deferLandSettleSideEffect("branch-landed", () => announceBranchLanded(notice));
+      deferLandSettleSideEffect("branch-landed", async () => await announceBranchLanded(notice));
     }
     const gateSkipped = normalizeGateSkipped(mergeResult.gateSkipped);
     if (gateSkipped && landedWorkspace) {
@@ -461,7 +465,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
         },
       });
       const ws = landedWorkspace;
-      deferLandSettleSideEffect("land-gate-skipped", () => notifyLandGateSkipped({ workspace: ws, ...gateSkipped }));
+      deferLandSettleSideEffect("land-gate-skipped", async () => await notifyLandGateSkipped({ workspace: ws, ...gateSkipped }));
     }
     const gateWarnings = mergeResult.merged === true ? normalizeGateWarnings(mergeResult.gateWarnings) : [];
     if (gateWarnings.length && landedWorkspace) {
@@ -499,7 +503,7 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
           console.warn(`land-gate-warnings artifact upload failed for ${warnWorkspace.id}: ${String(error)}`);
         }
         try {
-          notifyLandGateWarnings({ workspace: warnWorkspace, warnings: gateWarnings, artifactId, fullOutput: !anyTruncated });
+          await notifyLandGateWarnings({ workspace: warnWorkspace, warnings: gateWarnings, artifactId, fullOutput: !anyTruncated });
         } catch (error) {
           console.warn(`land-gate-warnings notify threw for ${warnWorkspace.id}: ${String(error)}`);
         }
@@ -536,6 +540,11 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
       if (await settleRestartKilledLand(command, current)) markTransitionCompleted();
       return { settled: true };
     }
+    if (!alreadyLanded && isRecord(command.result) && command.result.landingBlockerCode === DELEGATED_LAND_REFUSAL_CODE) {
+      await refuseWorkspaceLand(current, reason, command.id);
+      markTransitionCompleted();
+      return { settled: true };
+    }
     const transitioned = await updateWorkspaceStatusAsync(command.correlationId, nextStatus, {
       mergeCommandId: command.id,
       landGateQueue: undefined,
@@ -552,12 +561,12 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
     // announcements off it, so they run off the settle hot path (same as the success path's fan-out).
     if (nextStatus === "conflict" && !alreadyLanded) {
       // #2704 — the settle is the one conflict entry that never woke a steward (case A): give it its resolver.
-      deferLandSettleSideEffect("land-conflict-resolver", () => superviseLandConflictLater(current.id, reason, landedHead ? { tip: landedHead } : {}));
-      deferLandSettleSideEffect("land-conflict-semantic", () => emitWorkspaceTaskSemanticNotifications({
+      deferLandSettleSideEffect("land-conflict-semantic", async () => await emitWorkspaceTaskSemanticNotifications({
         workspace: current, transition: "land-conflict", actor: "workspace-merge",
         idempotencyKey: landFailureEventKey(current, command.id),
         outcome: { reason, commandId: command.id, status: nextStatus },
       }));
+      deferLandSettleSideEffect("land-conflict-resolver", () => superviseLandConflictLater(current.id, reason, landedHead ? { tip: landedHead } : {}));
     }
     if (gateFailure) {
       const gateFailedAt = Date.now();
@@ -571,9 +580,9 @@ async function settleWorkspaceMergeCommandResult(command: Command, markTransitio
       });
     } else if (!alreadyLanded && nextStatus !== "conflict") {
       // A conflict's owner hears from its resolver instead: the steward hand-off, or the hand-back (#2704).
-      deferLandSettleSideEffect("land-failed", () => {
-        notifyBranchLandFailed({ workspace: current, commandId: command.id, reason });
-        notifyLandUnconfirmed({ workspace: current, commandId: command.id, targetRef: current.baseRef ?? "main", kind: "merge-failed", detail: reason });
+      deferLandSettleSideEffect("land-failed", async () => {
+        await notifyBranchLandFailed({ workspace: current, commandId: command.id, reason });
+        await notifyLandUnconfirmed({ workspace: current, commandId: command.id, targetRef: current.baseRef ?? "main", kind: "merge-failed", detail: reason });
       });
     }
     return { settled: true };

package/src/workspace-config.ts

@@ -3,5 +3,5 @@ import type { WorkspaceConfig } from "@humwick/sdk";
 // Single source for the isolated-worktree symlink default (config-store + settings registry).
 // Only the untracked rig config is linked; AGENTS.md is tracked (#3516), so a worktree gets it from git.
 export const WORKSPACE_CONFIG_DEFAULTS: WorkspaceConfig = {
-  symlinkPaths: [".claude-rig"],
+  symlinkPaths: [],
 };

package/src/workspace-conflict-resolver.ts

@@ -81,7 +81,8 @@ async function withdrawArmedLand(ws: WorkspaceRecord, reason: string): Promise<"
 export async function handBackLandConflict(ws: WorkspaceRecord, now: number, why: string): Promise<ConflictHandback> {
   const meta = ws.metadata as Record<string, unknown>;
   if (conflictHandedBackForArm(meta)) return "skipped";
-  const instructions = handbackInstructions(ws, why);
+  const cause = typeof meta.mergeError === "string" ? meta.mergeError : undefined;
+  const instructions = handbackInstructions(ws, cause && !why.includes(cause) ? `${why}: ${cause}` : why);
   const withdrawn = await withdrawArmedLand(ws, instructions);
   // The steward's shutdown fences the row out of every other lane until it settles: the sweep
   // retries this pending hand-back (workspace-steward-watchdog.ts), never the steward path.
@@ -106,7 +107,7 @@ export async function handBackLandConflict(ws: WorkspaceRecord, now: number, why
     // One notice per recipient: it also wakes the owner, so no separate `landed-failure` (whose per-arm key
     // the land-conflict Task notice already holds). A notify failure falls through to the operator alarm.
     try {
-      routeNotification({
+      await routeNotification({
         type: "workspace.stranded_escalation", forceDelivery: true, ttlMs: null,
         scope: { workspaceId: ws.id, repoRoot: ws.repoRoot, author: ws.ownerAgentId, parent: coordinator ?? undefined },
         recipients,
@@ -130,14 +131,14 @@ export async function handBackLandConflict(ws: WorkspaceRecord, now: number, why
     }
   }
 
-  raiseOperatorAlarm({
+  (await raiseOperatorAlarm({
     clientId: `steward-handoff-unescalatable-${ws.id}:${strandKey}`,
     source: "workspace-steward-handoff-watchdog",
     subject: "Land conflict has no one to hand it back to",
     detail: `${branchLabel} in ${ws.repoRoot} has an unresolved land conflict and no owner, coordinator, or fallback to hand it back to (${why}). Configure AGENT_RELAY_WORKSPACE_STEWARD_FALLBACK or land/reclaim the worktree manually.`,
     view: "orchestrators",
     metadata: { maintenanceJobId: "workspace-steward-handoff-watchdog", workspaceId: ws.id, repoRoot: ws.repoRoot, branch: ws.branch, reason: why },
-  });
+  }));
   await transitionWorkspaceLandStateAsync(ws.id, "merge-error", { stewardHandoffEscalatedAt: now, stewardUnavailable: true, conflictHandbackPending: undefined, ...stewardEnded });
   if (withdrawn === "none") await finishWorkspaceStewardHandoff(ws);
   await createActivityEventAsync({
@@ -167,14 +168,15 @@ export async function superviseLandConflict(ws: WorkspaceRecord, reason: string,
 
 const inFlight = new Set<Promise<unknown>>();
 
-/** Fire-and-forget form for settle paths that must not await the wake (#1790). */
-export function superviseLandConflictLater(workspaceId: string, reason: string, opts: { tip?: string } = {}): void {
+/** Track the wake so deferred settle queues can drain its committed effects (#1790/#1870). */
+export function superviseLandConflictLater(workspaceId: string, reason: string, opts: { tip?: string } = {}): Promise<void> {
   const ws = getWorkspace(workspaceId);
-  if (!ws) return;
+  if (!ws) return Promise.resolve();
   const run = superviseLandConflict(ws, reason, opts)
     .catch((error) => console.warn(`[workspace-conflict-resolver] supervising ${workspaceId} failed; the hand-off watchdog retries: ${errMessage(error)}`))
     .finally(() => inFlight.delete(run));
   inFlight.add(run);
+  return run.then(() => {});
 }
 
 export async function settleConflictSupervisionForTests(): Promise<void> {

package/src/workspace-dead-owner-recovery.ts

@@ -1,19 +1,20 @@
+import { createCommandAsync } from "./commands-write";
 // Host-bound rescue for an unpushed dead-owner workspace. Kept separate from
 // the orphan sweep so command construction remains reusable without inflating
 // the disk⇄DB reconciler.
 import type { WorkspaceRecord } from "./types";
-import { createCommand } from "./commands-db";
+
 import { emitCommandEvent } from "./command-events";
 
-export function dispatchDeadOwnerRescue(orch: { agentId: string }, workspace: WorkspaceRecord): string {
-  const command = createCommand({
+export async function dispatchDeadOwnerRescue(orch: { agentId: string }, workspace: WorkspaceRecord): Promise<string> {
+  const command = (await createCommandAsync({
     type: "workspace.reconcile", source: "system", target: orch.agentId, correlationId: workspace.id,
     params: {
       action: "reconcile", workspaceId: workspace.id, repoRoot: workspace.repoRoot,
       worktreePath: workspace.worktreePath, branch: workspace.branch, baseRef: workspace.baseRef,
       baseSha: workspace.baseSha, autoReclaim: "dead-owner", requestedBy: "workspace-dead-owner-reaper", requestedAt: Date.now(),
     },
-  });
+  }));
   emitCommandEvent(command, `command.${command.status}`);
   return command.id;
 }